UCOP Ordered Spyware Installed on UC Data Networks (Updated 31 Jan; Updated 3 Feb)

The San Francisco Chronicle has coverage of an issue that has been circulating on faculty email networks at UC Berkeley for a few days.  The piece, "Cal professors fear UC bosses will snoop on them," is behind a paywall. The first sentence reads, "UC Berkeley faculty members are buzzing over news that University of California President Janet Napolitano ordered the installation of computer hardware capable of monitoring all e-mails going in and out of the UC system."   UC's Chief Operating Officer says "that UC policy “forbids the university from using such data for nonsecurity purposes.”  UC Berkeley's Senate chair replies, "What has upset a lot of the faculty was that the surveillance was put in place without consulting the faculty. In fact, the people installing the system were under strict instructions not to reveal it was taking place."  On the blog's Facebook page, we've had some debate about how new this capability is, with some faculty from various universities saying they've always assumed their university email could be monitored at any time, and others saying this is a new level of intrusion.

Here are two communications from UC Berkeley faculty, one about how faculty there came to know about the program, and the other a timeline of events.


EMAIL 1: January 28, 2016:

In recent weeks The Senate-Administration Joint Committee on Campus Information Technology (JCCIT) has learned that UCOP installed hardware on the campus network designed to monitor and possibly record all network traffic coming or going to the campus.

This secret monitoring is on-going.

UCOP would like these facts to remain secret.  However, the  tenured faculty on the JCCIT are in agreement that continued silence on our part would make us complicit in what we view as a serious violation of shared governance and a serious threat to the academic freedoms that the Berkeley campus has long cherished.

Some salient facts:

- The UCOP had this hardware installed last summer.

- They did so over the objections of our campus IT and security experts.

- For many months UCOP required that our  IT staff keep these facts secret from faculty and others on  the Berkeley campus.

- The intrusive hardware is not under the control of local IT staff--it sends data on network activity to UCOP and to the vendor.  Of what these data consists we do not know.

- The intrusive device is capable of capturing and analyzing all network traffic to and from the  Berkeley campus, and has enough local storage to save over 30 days of  *all* this data ("full packet capture").  This can be presumed to include your email, all the websites you visit, all the  data you  receive from off campus or data you  send off campus.

- UCOP defends their actions by relying on secret legal determinations and painting lurid pictures of "advanced persistent threat actors" from which we must be kept safe.  They further promise not to invade our privacy unnecessarily, while the same time implementing systems designed to do exactly that.

- It is very far from clear that UCOP has a better plan or better qualified IT security people or infrastructure than does the Berkeley campus, and they've shut these qualified people out of the picture.


EMAIL 2: January 29, 2016

According to other members of the Senate-Administration Joint Committee on Campus Information Technology (JCCIT):

A network security breach was discovered at the UCLA Medical Center around June 2015.

UCOP began monitoring of campus in networks around August 2015.

ONLY AFTER this monitoring, on August 27, 2015, did UCOP issue a new cybersecurity policy online under the heading of "Coordinated Monitoring Threat Response." The policy describes how UCOP would initiate "Coordinated Monitoring" of campus networks even though it is believed that such monitoring was already underway prior to the announcement of the new policy.


On Dec. 7, 2015, several UC Berkeley faculty heard that UCOP had hired an outside vendor to operate network monitoring equipment at all campuses beginning as early as August 2015. The process was apparently shrouded in secrecy and staff were instructed not to talk about it because of "attorney-client privilege" although it remains unclear how attorney-client privilege applies in this situation.  Extensive monitoring and storage of inbound and outbound Internet traffic at UC Berkeley was being performed, including storage and possible transmission to the outside vendor of packet headers with URLs and email metadata (to-from fields). The Berkeley campus IT staff does not collect this type of information because it violates UC Berkeley IT Privacy policy.

On Dec. 18, 2015, those UC Berkeley faculty sent a letter to UC President Janet Napolitano requesting more information and asking that the monitoring cease.

On Dec. 21, 2015, UC Vice President and CIO Tom Andiola met with most of the faculty who signed the Dec. 18, 2015 letter and Berkeley Assoc. Vice Chancellor and CIO Larry Conrad, and Berkeley Academic Senate chair Ben Hermalin.  Tom confirmed that monitoring equipment was installed at the Berkeley campus by an outside vendor and that it would be removed promptly and publicly disclosed by UCOP.

On Jan. 12, 2016, The Berkeley Joint Committee on Campus Information Technology (JCCIT) met with Larry Conrad and others.  The committee was informed that contrary to the Dec. 21, 2015 statements, UCOP had decided to continue the outside monitoring and not disclose any aspects of it to students or faculty.  The Senior faculty members of JCCIT met privately after the meeting and deliberated carefully about options, concluding it was their duty to come forward. To protect staff, administrators, and non-tenured faculty, it was decided an open letter should come from a group of tenured faculty, stating that "We are UC Berkeley faculty who have reason to believe that extensive monitoring and storage of inbound and outbound Internet traffic at UC Berkeley is being performed by an outside vendor at the request of the UC Office of the President, with no disclosure to UC Berkeley faculty or students...." A draft open letter "To Whom It May Concern" was circulated to all senior faculty who signed the Dec. 18, 2015 letter, stating our intentions to forward this to the New York Times.  Eleven senior faculty signed it.

On Jan. 15, 2016, the letter was sent to the New York Times and reached reporter Steve Lohr. Senior campus administrators in the Chancellor's office and UCOP were also sent copies.

On Jan. 19, 2016, UCOP Exec. VP and COO Rachael Nava sent a letter to those who signed the Jan. 15, 2016 letter.  The original version was marked "CONFIDENTIAL: DO NOT DISTRIBUTE" and invoked "Attorney-Client privilege". After several recipients responded to her via email questioning who is the client and why her letter must be kept secret, a revised version of the letter was sent the next day removing that language, stating: "All: Please accept my apologies with regard to the confusion on the attorney client privilege language on the letter.  It was a clerical error and was not intentional. Please find a revised version of the letter with the language removed." The letter admits that extensive monitoring is being performed by an outside vendor but does not provide a rationale for continuing this monitoring six months after it was initiated nor for the ongoing lack of disclosure from UCOP to students and faculty.


UPDATE: the Nava letter of 1/19/16:

EXECUTIVE VICE PRESIDENT - CHIEF OPERATING OFFICER
OFFICE OF THE PRESIDENT

1111 Franklin Street, 12th Floor

Oakland, California 94607



January 19, 2016

Dear Colleagues:

I am writing to follow up on earlier discussions about cybersecurity matters across the UC system and to share to the fullest extent possible the principles and considerations that guide the University’s efforts to respond to cyber attacks.

First, I want to thank you for sharing your concerns that we maintain the privacy protections enshrined in University policy even as we significantly strengthen our cybersecurity posture. As explained below, I do not believe these imperatives conflict, in fact, they reinforce one another in crucial ways. I would like to share some key principles and practices that help ensure that privacy protections are consistently upheld in the context of network security activities, some observations about the serious cyber attack we experienced at UCLA, and information about increasingly challenging attacks that are rising at academic institutions across the country.

As you know, on July 17, 2015, UCLA publicly announced that it had suffered a serious cyber attack. The attack appears consistent with the work of an Advanced Persistent Threat actor, or APT. An APT generally emanates from an organized, highly skilled group or groups of attackers that orchestrate sustained, well-planned attacks on high value targets. Today, much effort in the cybersecurity industry is focused on APT attacks because they are difficult to detect and highly destructive. While there is no evidence that cyber attackers actually accessed or acquired any individual’s personal or medical information at UCLA, the University decided to notify stakeholders. UCLA notified 4.5 million patients about the cyber attack. Within days, several lawsuits were filed against the Regents alleging various violations of State law, all 17 of which are now pending.

The UCLA attack, while exceptional in some respects, is part of an increasing trend of cyber attacks against research universities and health care systems. Institutions of higher education are increasingly targets of APT attacks because academic research networks hold valuable data and are generally more open. Indeed, the mission of our University is to promote knowledge sharing and research collaboration, which involves responsibly sharing data. A recent report from Verizon described educational institutions as experiencing “near-pervasive infections across the majority of underlying organizations,” and observed that educational institutions have, on average, more than twice the number of malware attacks than the financial and retail sectors combined.

APTs seek to illicitly harvest credentials across academic networks and then use those credentials, and the trust relationships among systems, to move laterally to other nodes in a given network. There are techniques to address such attacks, but I share these points to underscore the seriousness of the threat posed by APT attackers and the fact that, for cybersecurity purposes, a risk to what appears to be an isolated system at only one location may in some circumstances create risk across locations or units.
In recognition of these realities, President Napolitano has initiated a series of system-wide actions to strengthen the University’s ability to prevent, detect, and respond to such attacks. I believe these efforts are consistent with the reasonable expectations of the University community -our students, faculty, staff, patients, research sponsors, and academic partners- that we undertake serious efforts to protect sensitive data from malicious attacks. I also believe these actions are fundamental to realizing the University’s commitment to privacy. The following actions were taken:

• A leading cybersecurity firm was engaged to assist the University in responding to the cyber attack, in part by analyzing network activity at all UC locations to detect and respond to any APT activity
• Every location submitted a 120-day cybersecurity action plan to harden systems and improve administrative and physical safeguards
• A Cyber-Risk Governance Committee (CRGC) was established, with representation from across the system, including the Academic Senate, to oversee and guide system-wide strategies and plans related to cybersecurity. The CRGC has met several times already and is identifying key ways to strengthen our security posture while honoring the University’s commitment to academic freedom, privacy, and responsible fiscal stewardship
• A system-wide incident escalation protocol was developed to ensure that the appropriate governing authorities are informed in a timely way of major incidents, and
• Mandatory cybersecurity training was rolled out to all UC employees by October 1, 2015.

Several faculty members have requested detailed, technical information about the UCLA attack and the specific security measures taken in its immediate aftermath. I understand that some are concerned that such measures may have exceeded the University’s policies governing privacy. I believe such actions were well within the operational authority of the University and in alignment with policy. It is regrettable that as long as the UCLA incident remains the subject of pending legal matters, I cannot publicly share additional information that might correct some of these misimpressions. As a policy matter, however, I wish to address the privacy and governance concerns that arise in the context of data security, without any express or implied reference to the UCLA attack.

With respect to privacy, the letter and structure of the University’s Electronic Communications Policy (ECP) reflect the principle that privacy perishes in the absence of security. While the ECP establishes an expectation of privacy in an individual’s electronic communications transmitted using University systems, it tempers this expectation with the recognition that privacy requires a reasonable level of security to protect sensitive data from unauthorized access. For this reason, the ECP expressly permits routine analysis of network activity “for the purpose of ensuring reliability and security of University electronic communications resources and services.” (ECP, IV.C.2.b.) It expressly permits analysis of “network traffic” to “confirm malicious or unauthorized activity that may harm the campus network or devices connected to the network.” (ECP, V.B.) Significantly, “consent is not required for these routine monitoring practices.” (Emphasis added.) In short, the ECP reflects that, in some circumstances, the protection of privacy actually requires limited examination of electronic communications. (ECP, Attachment 1, V.A (noting that failure to prevent unauthorized access itself undermines privacy and confidentiality).) This is consistent with fair information practice principles and the University’s duties under laws and regulations that require the use of physical, technical, and administrative safeguards to secure sensitive information.

The University takes great care to ensure that its practices reflect the balance outlined in the ECP. I would like to illustrate significant measures that we undertake to honor privacy rights in responding to a cybersecurity threat.
Even in time-sensitive circumstances, privacy impacts are typically evaluated before undertaking a coordinated network security effort. Appropriate privacy protection measures are embedded into the underlying scope of work both at the planning and execution stages of a network security effort. Such analysis typically includes an evaluation of the specific technical and analytic techniques to be used and whether they are consistent with the ECP. It also often means defining an appropriately limited scope for network analysis activity, focusing such analysis on known signatures for APT activity and related indicators of compromise. For vendors, the ECP requires scope discipline to be enforced by contract. (See ECP, IV.A (requiring vendors to be contractually bound to honor University policy).)

Layered review is another privacy-enhancing measure used in appropriate circumstances.1 Layered review requires security alerts to be resolved in tiers, with each tier representing a limit on the type and amount of data to be reviewed. A layered review starts at the lowest tier, using automated review and basic metadata to resolve the security alert at that level. In circumstances where a security threat cannot be resolved at a lower tier or with automated means alone, the human-readable content of an underlying communication may be reviewed. The ECP limits such inspection to the “least perusal” necessary to resolve the concern. (ECP, IV.C.2.b & V.B.) To inspect content beyond what can be examined through “least perusal,” the ECP requires user consent or access without consent under a campus’s procedures, which typically involves a decision from the campus’s senior management.

I understand that some faculty members may be concerned about storage and use of data collected through network security analysis, including questions about data being used by the University for other, unrelated purposes. The ECP forbids the University from using such data for non-security purposes, (ECP, II.E.2, IV.A, & IV.C.2.b (prohibiting University employees from seeking out, using, or disclosing personal data observed in the course of performing university network security duties)), and violators are subject to discipline.2 With respect to storage, much data collected through network analysis may already be stored elsewhere within the University’s network ecosystem (or even with third party cloud or other providers), independent of any network analysis activity. Data collected or aggregated specifically for network security purposes is only stored for a limited time, segregated in a highly secure system, and forensically obliterated thereafter. In some circumstances, a preservation of certain data related to litigation may be required by law, which may result in a longer storage period for a limited amount of network analysis data subject to such a mandate. With respect to third party requests for such data, the University has a long history of defending against improperly intrusive requests, including requests under the Public Records Act.3

Governance is also a critical aspect of this discussion. Ensuring that all stakeholders are fully enrolled in developing the University’s cybersecurity policies going forward is essential. As you know, the President has launched a coordinated system-wide initiative to ensure that responsible UC authorities are appropriately informed about risks, that locations act in a consistent and coordinated way across the entire institution, and that the University can sustain action to manage cyber-risk. A number of structures have been put in place to elevate the importance of cybersecurity within University governance, some of which I described above but elaborate here for emphasis:

• The President asked the Chancellors to each appoint a single executive to lead efforts to review and improve cybersecurity at their location. These positions are the Cyber-Risk Responsible Executives (CREs), and each position reports directly to the Chancellor or location chief officer.
• A single escalation protocol has been implemented across the UC system to facilitate appropriate notification and handling of cybersecurity incidents. The protocol is intended to drive consistent analysis and response to cybersecurity incidents. It is being piloted and will be reviewed for effectiveness by the CRGC after six months.
• In addition to establishing the CRGC described above, the President has appointed a Cyber-Risk Advisory Board, composed of six internal and external expert advisors, to support the CRGC and provide information and advice about emerging issues and best practices in cybersecurity, and to help develop aggressive and effective approaches to managing cyber-risk, consistent with UC’s teaching, research, and public service mission.
• Finally, a Cyber Coordination Center is being launched to help coordinate a variety of activities across the locations.

With specific reference to faculty governance, the President has reinforced with senior management the need for ongoing dialogue with our faculty and Senate leadership. The Senate has a robust presence at the CRGC, and I believe the CRGC is the best forum to develop mechanisms and policies for further ensuring that Senate leadership is fully engaged in policy development and briefed in a timely way regarding ongoing security matters and practices.
I also welcome a discussion about how to harmonize broader cybersecurity efforts with existing, campus-specific information governance guidelines. Some campus-level guidelines, established as part of system-wide information governance initiatives, limit the specific technologies and methods that may be used for network security activities, including some methods in ordinary use at other University locations and use of which may be necessary to comply with legal duties or to effectively evaluate a specific threat that may implicate multiple locations.

Given the difficult and shifting challenges worldwide in terms of cybersecurity, there is no monopoly on wisdom here. It is my intention to approach these issues with humility and openness, believing that our efforts will only be enriched by an exchange of ideas and viewpoints. I welcome your engagement on these issues and look forward to a deeper, joint effort to protect the privacy of our users and the security of the University’s systems.

Sincerely,
Rachael Nava
Executive Vice President -
Chief Operating Officer

cc: Academic Senate Vice Chair Jim Chalfant

Vice President Tom Andriola

Deputy General Counsel Rachel Nosowsky

Associate Chancellor, Nils Gilman

UCB Professor of Business and Economics, Ben Hermalin
______________________________________________
1 A layered review is not actually required by the ECP and may not be appropriate in all cases, but it illustrates the types of measures used to rigorously observe privacy principles.
2 The ECP creates a specific exception for circumstances where an employee incidentally observes obvious illegal activity in the course of performing routine network security activities. (ECP, IV.C.2.b (defining exception for disclosure of incidentally viewed evidence of illegal conduct or improper governmental activity).)
3 Public Records Act requesters may seek far more intrusive access to the content of faculty or staff records than what the ECP permits for network security monitoring. The limits on the University’s own access to electronic communications under the ECP do not apply to Public Records Act requests.


2 February Updates

Suhauna Hussain. “A Web of Cyber Controversy: UC Monitoring of Campus Network Traffic Sparks Outrage among Faculty.” The Daily Californian, February 2, 2016.

Steve Lohr,  “At Berkeley, a New Digital Privacy Protest.” The New York Times, February 1, 2016

Statement from UC Berkeley CIO, 2 February:

We believe that the existing UC Berkeley policy that has been in place for a number of years strikes a privacy-security policy balance, is robust and reflects this University's best traditions and values. It is the result of a collaborative campus effort that included both staff and faculty, and like them the Berkeley administration believes that all IT policies and procedures, whether system-wide or local, should be transparent and accountable.

Larry Conrad
Chief Information Officer
UC Berkeley


3 February UPDATES:

• The UCSB Faculty Association requested clarification on the surveillance program from Santa Barbara Divisional Senate Chair

Dear Kum Kum,

We write because we are deeply disturbed by the recent report that UCOP has installed surveillance software “capable of monitoring all e-mails going in and out of the UC system”
(http://www.sfchronicle.com/bayarea/matier-ross/article/Cal-professors-fear-UC-bosses-will-snoop-on-them-6794646.php?t=1c3d144ee43ba53be4&cmpid=twitter-premium%20via%20@sfchronicle).   While we are aware that officials at UCOP have sent a letter explaining the context and rationale for installing this software, we do not find that the letter addresses adequately the potential threat that taking such measures poses to academic freedom and shared governance.   As the Board of the UCSB Faculty Association, we request that you ask Chancellor Yang for an immediate and full accounting of all electronic surveillance capabilities now in existence and/or in operation at UCSB, and that you make that information available to all members of the UCSB Academic Senate.
With thanks,
Julie Carlson
Jorge Luis Castillo
Nelson Lichtenstein
Constance Penley
Erika Rappaport
Elisabeth Weber
Robert Williams

• UCSB Chancellor Henry Yang sent a modified version of COO Nava's 1/19 memo, which you can read here.
• The UC Academic Senate Committee on Academic Computing and Communications has issued a statement we've posted here.  Although the object to the end-run around shared governance in the name of urgent security matters, they give a pass to the surveillance itself--see the final 2 bullet points in particular.

UC Faculty Associations Oppose Proposed Changes to UC Pension Plan

This is the statement released today by the Council of UC Faculty Associations (CUCFA). A link to their petition can be found below.

The University of California is currently considering introducing a new pension plan for its employees hired after 2016.  These proposed changes will dramatically reduce pension benefits for most new faculty. The Academic Senate will be reviewing the proposals over the next few weeks. Your opportunity to provide input to the Senate lasts just a couple weeks. For some purposes, it will be most effective to provide input this week. Contact information is at the end of this document.

This ill-conceived and ill-advised plan, which was negotiated behind closed doors by President Napolitano and Governor Brown without any engagement with the Academic Senate, the Regents, the Legislature, or the larger university community, will do serious damage to the quality of the University of California.

While the details are highly technical the implications are not:

1) This is a serious cut in benefits to faculty and many other professional staff, such as staff scientists and nurses, hired after July 2016.  (See pages 44, 45 and 84 of the task force report.)

2) UC faculty are already much more poorly compensated than faculty at UC's peer institutions despite the fact that the cost of living in most parts of California is very high. This plan will make it much harder to attract faculty and other professionals and keep them here.

3) This plan does not do anything to make the existing pension system healthier and could actually decrease the rate at which the unfunded liability is retired. (See page 57 of the task force report.)

We agree with the assessment of Academic Senate leaders J. Daniel Hare and James A. Chalfant's analysis, who concluded:

"If salaries don't increase to compensate for these reduced benefits, then UC will have to settle for a lower-quality of faculty who did not receive better offers elsewhere. Many UC faculty members were hired in spite of more lucrative salary offers elsewhere, just as many have either declined outside offers or declined to pursue them. It may have been true at one time that benefits made up for our uncompetitive salaries. The 2014 Total Remuneration Study showed that no longer to be the case. While salaries and benefits continue to lag, and we are contemplating making the lag even greater with the new-tier options, it is important to note that most of the non-pecuniary attributes of UC employment also are declining."

As Academic Senate Chair Dan Hare stated in his remarks to the Regents in September:

"Any reduction in either salary or benefits surely will have consequences for the ability of UC to build and retain a future faculty that is as distinguished as the current faculty. As recommendations are brought forward in early 2016, I encourage the Regents to carefully consider not only the budgetary cost of future retirement options, but also their impact on how faculty members behave in terms of recruitment and retention. If we are not careful, small budgetary savings will risk far greater costs to the University, our students, and the citizens of California."

We urge you to sign our petition to express your opposition to proposed changes to the UC Retirement Plan. We will forward the names of those that sign to local campus faculty welfare committees so they are aware of local concern about this issue.

UCOP has also set up a comment link where you can provide your feedback on the task force recommendations. We urge you to express your concerns about the plan there and please also send a copy of your comments to us at newtier@cucfa.org.

Pensions, Politics, and the Failures of Leadership

The Task Force charged with making a silk purse from the sow's war of President Napolitano's pension agreement with Governor Brown issued its report on Friday.  To no one's surprise, the Task Force indicated that the task was impossible; given the limits the Task Force faced most faculty and many staff (especially in the health sciences) hired from July 1, 2016 will face dramatically reduced retirement benefits compared to current employees.  This situation results from two interrelated factors: the actual budget deal that President Napolitano accepted and the desire on the part of Vice-President Brostrom that there be savings produced by the new 2016 tier.  In exchange for a relatively small (about 5% of UCRP's unfunded liability) short-term State contribution to UCRP, UCOP has agreed to reduce the compensation for generations of employees to come.

In this post I am going to do several things:  first, describe the contexts within which the Task Force was presented with its impossible task; second, provide a broad indication of the Task Force Majority's recommendations; and third, describe the process to come with some suggestions and comments on the situation facing faculty and unrepresented staff (as is often the case represented staff may have more control over their situation since they are entitled to collectively bargain on these matters).

THE CONTEXT

You will recall that following UCOP's Fall 2014 proposal for a 5% tuition increase, UC and the Governor's office established the so-called "Committee of Two" to examine the cost structure at the University and secretly negotiated a budget agreement.  (For the Senate's Committee on Planning and Budget's critique of this process see here).  Despite the hullabaloo that accompanied those high level discussions it was clear from the start that the Governor was only interested in cost controls and that the likelihood that the University would gain in substantial ways was quite low.  In the end those expectations were met.  Although UC received a promise from Governor Brown that he would extend his planned base budget increases for an additional 2 years he succeeded both in locking UC in an ongoing under-funding and also in increasing the demands on the University.  In addition, the threat of tuition increases alienated the Legislature and, at least indirectly, led to UC having to agree to expand resident undergraduate enrollment without sufficient funding to pay for the increased costs.  We have commented on the weaknesses of that deal before (here, and here).  But as part of that deal President Napolitano accepted a permanent reduction in pension benefits for future employees in exchange for the Governor's promise of a temporary State contribution to UCRP.s unfunded liability of $436M over three years.

Under the terms of President Napolitano's agreement with the Governor, UC is committed to reducing the cap on the amount of income that can count in calculating an employee's pension benefits in UCRP.  UCRP as you know is a Defined Benefit Plan.  As a result an employee is promised an annual payment after retirement based on a calculation that takes into account an employee's three highest salary years, years of service, and age at retirement.  For employees hired before July 1, 2016,  earnings up to the Federal Cap (now about $265,000) could be counted.  For those hired on July 1, 2016 or later the University is proposing to shift to the PEPRA State Cap (now at $117,020 and tied to inflation). It is important to recognize that these numbers are limits NOT on retirement benefits (which are lower) but on the amount of earnings which can be used to calculate retirement benefits.  Starting with those hired on July 1, 2016 earnings above the PEPRA cap will simply not be included in the calculation.  The Task Force estimates that these new rules will affect roughly 25% of employees hired on or after July 1, 2016 (13-14).  These individuals tend to be concentrated in the Ladder Faculty, the Health Sciences, and Management (13) Because of the large number of represented nurses. about 40% of these individuals will have the ability to engage in bargaining over these terms.

The Task Force was charged with figuring out how to change the retirement system.

THE PROPOSAL

The basic parameters of the proposal can be sketched quickly (and you can find them at pages 5-7 of the Report).

The Task Force is proposing that new employees be given two options:

1) The first (Plan A) is hybrid plan.  In it an employee would participate in the Defined Benefit Plan offered by UCRP (with benefits calculated on income up to the PEPRA cap) with a Supplemental Defined Contribution Plan (with University contributions) on income between the PEPRA cap and the Federal Cap.  Employees who choose Plan A would continue to vest after 5 years (as is the case now) and would continue to contribute the same amount annually to their pension as do employees hired before July 1, 2016. Once in Plan A you would be committed to Plan A.  Plan A is proposed as the default choice.  It is important to note that the Defined Benefit portion of this proposal would operate under the conditions imposed on the 2013 Tier--who already had a later retirement age than earlier hires.

2) The Second (Plan B) is a Defined Contribution Plan with both the employee and the University contributing up to the Federal Cap.  Again, the amount that the employee would contribute would be the same as Plan A.  Employees who chose Plan B at hiring would be allowed to switch to Plan A after 5 years of employment (this would be a one-time opportunity).

A Defined Contribution Plan, as you know, promises a certain amount of annual contributions to a pension fund but no obligations as to payouts after retirement. The risk in the latter type of plan is borne by the individual (just as s/he accrues greater portability and the benefit of any investment brilliance).  A DC plan can be better for shorter term employees.  But the employee bears the risk of either poor investment performance or longevity risk.  It is not exactly clear why the Task Force chose to include a DC plan (it was not required by the Budget Act).

The actual details of the proposal are considerably more complex and depend on a variety of options concerning the actual amount of contributions (by the University) to the different plans, the expected annual growth of the value of the DC plans, the costs to the University of choosing between different contribution levels, the age of hires and the distribution of choices between plans, etc.  These questions mean that the actual effects of these two plans are still in flux as both the Task Force Report and Senate Leaders Dan Hare and Jim Chalfant make clear.  So university employees are being asked to respond to a concept without precise numbers on which to make that decision.

But despite the complexities it is clear that the retirement benefits for affected future employees will be dramatically reduced. (for a quick way to see this effect see 84)

MOVING FORWARD

The Academic Senate (and I assume staff associations) have until February 15th to formulate responses to the Task Force Report.  The Senate, in turn is asking for comments and responses by February 5th.  I want to underline these dates because they show quite clearly the closed-off nature of the process.  Despite the claims by both UCOP and the Task Force about consultation, faculty and staff at large have less than a month to respond to a proposal that will significantly change the compensation for future employees with an unknown effect on the University as whole.  Given this situation I would argue that the Senate and other faculty and staff organizations proceed on two tracks.

The first, involves a series of technical considerations but is politically the easiest to do.  This option would be to insist that wherever the Task Force provides alternatives in the amount of the University's contributions to retirement income that President Napolitano and the Regents choose the most generous alternative.  In addition, the proposed opportunity to switch from Plan B to Plan A should not be set at 5 years but later to allow for faculty to make the decision after their cases for tenure have been resolved.  The guide provided by Chair Hare and Vice-Chair Chalfant is the best place to start for evaluating these different questions.  But this avenue is the conventional one.

The second and more significant option is to reject the proposal.  I think that the Task Force did the best that they could under the circumstances.  And I recognize that trade-offs often need to be made. But the funding gained under this agreement is not worth the damages done to compensation nor the potential damage done to the University as whole.  The Senate should oppose this deal even if it means returning the initial payment of $96M.  There are a variety of reasons for this:

1) As I indicated above there is no question that acceptance of this deal will reduce retirement benefits for a significant portion of future employees.  Nor is there any reason to think that the University has any real program to make these losses up in other ways.  Indeed, as the Report indicates, the University does not have an accurate idea of total compensation and competitiveness (the last report having been done in 2009).  (64-65)

2) What does the University get in return in financial terms?  Not much.  As I indicated above, the three year state contribution addresses only a very small amount of the unfunded liability. And according to the calculations of the Task Force, establishment of the New Tier under present conditions will speed up the elimination of the unfunded liability minimally if at all.  In fact, under certain scenarios the elimination of the unfunded liability might be faster under the 2013 Tier (with borrowing) than under most of the 2016 options.  (57)  Nor does there seem to be much savings in yearly terms.  And these savings are placed far down the road as individuals hired under the 2016 come to replace the 2013 Tier in retirement.

3) The pension deal and the Task Force proposal mark a crossroads for President Napolitano and also for shared governance within the University.  It is conceivable that the President did not realize the extent to which the pension deal would reduce benefits.  But faced with the Task Force report it is clear that the reduction would be significant and that the financial benefits are limited.  If there is significant opposition to this proposal President Napolitano would have the option of concluding that the deal was a mistake.  If there is significant opposition President Napolitano would also have the option of demonstrating an openness to shared governance on policy rather than just on implementation of policy already decided by senior managers.  It is possible, of course, that UCOP has calculated that given overall market conditions they are willing to weaken recruitment and retention of top faculty and staff (that certainly is the implication of the Governor's position).  But at least we would be clearer on that.

CONCLUDING COMMENTS

1) If the University wants to consider revamping the retirement system it should, at the least, demand that the State acknowledge its own obligation to funding of UCRP and restart contributions on an ongoing basis.  Much is made of UC's "pension holiday" and it clearly went on too long.  But it is important to remember that there has been a State "pension holiday" from funding UCRP as well (as it funds other public employee retirement systems).  Renewed ongoing funding would enable UC to eliminate the loss in retirement income or total compensation on the one hand and to reinvest in core functions on the other.

I recognize that this is a politically challenging route.  Taking this route would not be without its dangers in terms of relationships with the governor and the legislature or in terms of motivating those who are opposed to all pensions (especially public ones) But the Governor is at best disingenuous on this issue.  If you look at his 2016 budget proposal, he includes UCRP as part of the debts and obligations under Prop 2 when he wants to indicate how much debt the State has.  (3)   But as a matter of policy he refuses to acknowledge that UCRP is a permanent state obligation.  Moreover, even the short-term funding is only a gubernatorial promise at this point.   The Task Force, to be honest, was less than forthright in this regard when they open their report with the statement that "As part of the 2015/2016 Budget agreement between the University, the Governor, and the Legislature, the State will provide a total of $436 million for the University of California Retirement Plan (UCRP) over the next three years." (4)  The Legislature has not engaged in any multi-year promise.

2) If nothing else, the Report of the Task Force is another indication that UCOP's tuition gambit and subsequent "Committee of Two" process was unsuccessful.  Although I commend President Napolitano for actually advocating for increased State funding (something her predecessor was particularly poor at doing) the Tuition strategy seems to have backfired.  The Legislature was alienated, the budget deal that resulted showed little if any improvement from what the Governor had indicated previously, UC has now agreed to take large numbers of additional students without adequate funding, and the pension deal was a mistake.  Moreover the secrecy of the process not only sidelined effective shared governance but, as with the proposal on the governance of the health sciences, precluded an effective mobilization of debate and ideas about the best ways for the University to move forward.  As with so much of the debate over higher education today, efficiency and speed is held in higher regard than thoughtfully considering the long-term implications of policy and practice or aiming to improve the quality in higher education (as opposed to simply lowering spending). Rushing to produce a bad idea just means you produce a bad idea more quickly.

For your convenience:

The Task Force Report can be found HERE.

The Guide to the Report produced by Chair Hare and Vice-Chair Chalfant can be found HERE.

Top Trends for 2016 Higher Ed: Earth-Two Edition

Since Flash Comics writers discovered the existence of Earth-Two in 1961, readers have been tracking unexpected divergences between the paired planets that exist in parallel dimensions.  The Earths have generated divergent histories with more or less the same people. This makes it easy to study the effects of variable reactions to structural forces like culture, law, and economic policy, since backward leaders and our unfortunate "human nature" reign on both worlds-- as on the other Earths DC Comics has discovered since.

There's one other thing:  Earth-One is considered a Silver Age and Earth-Two a Golden Age planet.  The terms derived initially from the age of comics in which their lead superheros evolved, but came to be applied to the quality of the planets themselves.  Life is better on Earth-Two: less impoverished, less tyrannical, less hypermasculine in leadership styles, and less inclined towards multiple gun deaths.  Some believe that the lower, Silver Age status of our Earth-One results from its lower cultural intelligence.  This inclines it to manage social relations with fixed procedures and peer communications with programming.

How do the Earths compare on major university trends?

1. Both Earths experienced our old friend permausterity that we've discussed before.  In 2015, a small uptick in state appropriations left outlays nearly 20 percent below their pre-recession levels (summary page 8). Meanwhile, the historic backfill for state cuts, student tuition hikes, became politically untenable, as UC President Janet Napolitano found out when she couldn't get even a piece of her 5% a year for 5 years through Sacramento. A second solution, ed-tech, was to step into the breach with massive savings through technological efficiency at the same level of quality.  That fix failed completely, though many politicians continued to flog it.

The upshot for 2016 is that real funds for the educational core will stay flat or fall as a share of overall expenditures, even as the student share of public college expenditures has grown from 1/2 to nearly 2/3rds of the total.  So Earth-One's 2016 default will be sagging public college quality as these institutions and their less-privileged students fall further behind the instructional and research trends set by the wealthy private universities, which in 2015 were richer and more exclusive than ever.

Stratification between public and private will be echoed by more of the same within public systems. The public flagships will stay afloat while the more vulnerable campuses drift into whatever shallows will keep most decks above water. Nick Fleisher and Richard Grusin discussed cuts at the important Wisconsin-Milwaukee campus, which educates a large urban population while dealing with unjustified reductions.  These diverging fates were intensified by a tradition of gross inequality in per-student funding across state systems: Sara Goldrick-Rab and Tammy Kolbe discussed the lopsided figures for the University of Wisconsin system.

E1 academic leaders no longer dream of fixing a problem that endangers the core purpose of public colleges, which is equal education.  E1 citizens didn't vote for the deterioration of quality of campuses serving the poorer and more remote parts of states while their tax dollars support the flagships that serve the most non-resident students, but that is what they are going to get. They face a renewed elitism of public college education, right when universal quality is more necessary than ever.

Humans are no less foolish on Earth-Two. But E2 has better communication from grassroots to the executive tiers, where for cultural reasons they care more about how C-suite decisions affect life in the trenches.  Thus E2 Napolitano started 2016 by telling her staff:

Stop bringing me these nickel solutions.  Stuff like UCOP Venture Capital may be good PR, but will generate a drop in the bucket if we're lucky. You realize it's not 1995 anymore?   Non-resident tuition is a band-aid--anyone can do the math.  I know UC students who couldn't get detailed paper feedback from the faculty we're not hiring even if we passed out handguns at every campus gate.  I don't want to see another Jerry budget with just 4% for us again. I need a 16% state funding increase each year for five years, starting now.  Tell Jerry "tuition is frozen forever" if he rebuilds state funding levels.  Make a list of exactly how all of the new money will go to the educational core--I mean 100%.  First explain what the hell UC "educational quality" is.  Call some actual UC instructors why don't you?  Tell Jerry we won't spend one new dime on executive comp.  We're going to announce a two-year freeze on executive hiring.  And please, start de-gunking the ridiculous bureaucratic processes around here.  Re-engineer something rather than just make campuses comply with more standardization.  And call those guys that say we can get 2001 low-tuition and good funding for another 30 bucks a year or whatever it is. Figure out how we can support it!

No Earth-One president would talk like that.  And yet it follows from two Earth-Two cultural practices: (1) open, reciprocal communication between execs and the least powerful of their institutional cultures--undergraduate education, disciplines without extramural income, low-income students; (2) the refusal to sacrifice weaker units for the sake of the strong.  E2 senior managers move from educational needs to  budget requests rather than the other way around, with the goal of quality for the whole.

2. Massive student protests against racism.  In 2015, both Earths saw large anti-racist protests sandwiched between, on the one hand, ongoing police killings of unarmed Black people followed by the non-indictments of key shooters, and on the other, the Supreme Court's triple-jeopardy reconsideration of affirmative action in the Fisher case (triple because the 2013 Fisher decision was already a retread of the 1990s Hopwood cases that were decided by Bollinger in 2003). Racism on campus (Missouri, Yale, Ithaca College, etc.) showed itself to rise from campuses failing to shelter students from the wider social regression.  E1 and E2 political leaders had tolerated or encouraged a boom in economic inequality and tolerated or encouraged the resegregation of the American school system. Meanwhile, the US college system also became Separate and Unequal: most new white students went to more selective, wealthier colleges while most new students of color went to less selective and poorer mass institutions.  Colleges continued the minoritization of students of color even as they formed pluralities or majorities of student bodies, and did not explain and demand strong race-conscious policies. They outsourced racial politics and social integration to their offices of student affairs, and on Earth-One and Earth-Two alike, didn't generally make students of color feel like they were first-class citizens on their own campuses.  Faced with intensive protests, E1 senior managers offered to listen better while rethinking some specific instances of their tradition of concealing their complicity with larger racist forces (like the presidency of Woodrow Wilson).   Structural changes stayed off the table. 

Meanwhile, on Earth-Two, a staffer in the University of Missouri Office of the President read a content analysis of anti-racist student demands across the country.  She saw that the most frequent were for more faculty of color, more student diversity, more courses on race, ethnicity, and sexuality theory, more institutional support for students of color, more diversity training, and better mechanisms for reporting, sanctioning, and preventing hate crimes.  Wow, the staffer thought, these are the demands of the 1980s! Why didn't we met these years ago?

In early 2016, she tracked down E2 Mizzou's substitute president and spoke as follows:

Look, our protesters are the children of the students who denounced the lack of faculty of color back in 1985.  Most of higher ed has spent the last thirty years screwing around.   University managers look like racist tools because they can't do much better than the right-wingers that run Congress and the Supreme Court.   Here is part of the speech I suggest you let me write: "I support racial equality of outcome, not just of opportunity.  The fact that society maintains racial disparity in everything--income, wealth, health, longevity, education, you name it--doesn't mean universities need to.  So as of today, my administration stands for equality of racial outcomes.  Now we need to figure out how to get that at Mizzou Earth-Two.  You've heard of the flipped classroom?  Mizzou will start with the flipped administration.  We'll put students in charge of designing the grievance processes and curricula that they prefer. Student affairs staffers and faculty will act as a support structure for advice and counsel.  Then students, faculty, staff, and senior managers will hold a series of quiet meetings and loud town halls--what do you all call them? General Assemblies?--in which we'll hash out the results democratically.  STudents won't decide on their own, but they will lead the process.  Another thing we're going to do.  My colleague, the new head of the Columbia flagship campus, will work with the Missouri system as a whole to equalize funding across this great system. We have a plan for a leveling up over a five year period.  Our goal is to fund the campuses with higher percentages of students of color at the same per-student level as the largely white flagship campus.  We need equitable funding for equitable racial outcomes, and Missouri is going to lead what I am sure is going to become a national trend."  

3. Admin's Autocracy Crisis: The newly-installed head of the University of Iowa, Bruce Harreld, drew new attention to himself by saying that professors who failed to prepare lessons should be shot. On Earth-One, faculty awareness of domineering Boards and weakened Senates had been growing throughout 2015. One piece called it Veblen's Nightmare.   In E1 Iowa, the main response was a librarian's eloquent repudiation of President Harreld's comments, which broke with the taboos of a faculty deference culture that had been helping administrators ignore or override faculty expertise even in core faculty arenas.   In an email to E1 Harreld, Lisa B. Gardinier explained,

There are many schools of pedagogy and, being a university, there are several, if not many, good ways to plan lessons, classes, and curriculum, and our academic freedom extends to teaching in the way we see fit to the content on which we are trusted to be experts, preferably with adequate support and opportunities for the development and improvement of our teaching skills throughout our career. Poor planning is an unfortunate waste of both the instructor’s and the students’ time and research but is not a capital or corporal offense, leading me to the second part of your comment.

For a university president to use the term “should be shot” so flippantly, and just a week after the most recent highly publicized mass shooting and in a tense atmosphere of racist law enforcement violence, is horrifying and unacceptable. For someone who claims to sideline his vision to that of the university community, to casually suggest potentially lethal punishment as consequences for failure to comply with a narrow perception of the correct way to fulfill one of our duties, is irresponsible and unprofessional. You may not have been kicked out since your appointment, but not for lack of trying, and nor is anyone is advocating for bodily harm to come of you or anyone complicit in your hire.

Earth-One greets Lisa Gardinier's open critique as an act of individual courage and candor.  Earth-Two, being more culturally evolved, sees it as an act of public witness in an institutional context, pointing toward collaborative emulation with a goal of social health.  Others take up the challenge of frankness, writing E2 Harreld with non-anonymous appraisals of his performance and its effect on their feelings about their institution and their work.  The E2 Academic Senate encourages public statements as expressions of an ethic of general participation in self-goverance.  Over a few weeks, as open exchange becomes the rule rather than the exception, flaming and trolling all but disappear, as their function of nuking the enemy becomes less attractive psychologically.  The same goes for retaliation and shunning, twin norming procedures whose coercive and negative effects become deceasingly acceptable as more people survive and even thrive on commentary.  Iowa becomes a model of open governance by generalized peer-review.  It becomes an experiment in combining stable and regularized structures with an ethics of disclosure.  Once someone names this the operative community, and E2 President Harreld enthusiastically joins in, the chair of the E2 Iowa Board of Regents responds.

When we hired Bruce, we were following the American Council of Trustees and Alumni (ACTA) script that said we needed to take ownership of the university away from faculty, staff, and students.  We felt entitled to brush off the AAUP's rejection of our procedures, and rule through negative stereotypes of various university subgroups.  Now my earlier dismissal of faculty critiques as "embracing the status quo of the past" seems kind of dumb.  Since I'm too old to change, I'm announcing my resignation from the Board, so I can find a sphere where my kind of unilateral top-down decisionmaking still makes sense. Universities need every single person's full intelligence or they don't work.  I wish Iowa all the best.

These three examples from DC Comics archives show Earth-Two does better not by having special Jedi foresight and discipline but by having open institutional cultures.  Their universities are less managerial and more democratic, less autocratic and more proceduralist, less algorithmic and more widely informed.  Luckily, Earth-One can learn from the more advanced cultures of Earth-Two.

A belated and hopeful Happy New Year, whichever planet you're from.

Follow Austerity Road: The Governor's Higher Education Budget

Governor Brown has issued his proposed 2016-2017 budget.  Shorn of its rhetorical invocation of technocratic answers, the Governor's Higher Education budget simply locks in the continuing underfunding of CSU and UC (I won't offer an analysis of the community college budget in this post).  When I first read the budget, I was tempted to think that Governor Brown was now governing openly as an Eisenhower Republican.  But Eisenhower actually helped expand higher education for the country. He did not diminish it.

UC

The Governor's proposal fundamentally restates the agreement reached in secret negotiations with UCOP under the auspices of the so-called Committee of Two.  There is the $125M general fund increase that the Governor had intended as part of his "sustainability" plan (about 4% of this year's base funding) and the one-time $171M contribution to the UCRP unfunded retirement obligation. (18) The proposed budget continues the supplemental $25M appropriation to pay part of the costs of  the additional 5000 California resident undergraduate students that UC has agreed to admit by next academic year.  This appropriation is about half of what the State appropriated for enrollment expansion during the Schwarzenegger administration.  There is no sign that the Governor is willing to fund the additional resident students that President Napolitano has indicated she would like to admit above next year's 5000..  As per the agreement there will be no increase in resident tuition  in 2016-2017.  The base General Fund allocation is $3,260,544,000.  This number does not include the one-time UCRP payment.

The Governor's office, of course, would like to spin these appropriations as indications of a serious refunding of the University.  But in reality what Brown has done--and what UCOP has accepted--is the permanent under-funding of UC.  The Governor's proposal will finally restore general fund appropriations to approximately the level of 2007-2008.  But the resident student population is considerably larger.  The 2007-2008 budget assumed a total (undergraduate, graduate, and health science) resident student population of 198,455. (4)  The 2016-2017 budget assumes a resident population of 216,897. (10)    Allowing for inflation and the agreed-upon (inadequate) marginal cost of increased enrollment, that leaves the state's appropriation to the base UC budget over half a billion dollars below 2007-2008.  Of course, this estimate does not include the explosive rise in Cal Grant funding tied to the rise in tuition and the increasing total costs of attendance--each an indication of the extent to which the State continues to shift the burden of higher education costs onto students and their families.  On the other hand, it does not include include the additional costs for UC Merced or the other mandated increases which would likely outweigh the growth in Cal Grants..

CSU

The proposal for CSU is similar in its implications.  The Governor proposes $125.4M in base increase, $15M in funding available through changes in the Middle-Class Scholarship Fund, and $7.9M for leasing properties coming to a General Fund increase of $148.3M.  In addition there will be a $35M one time appropriation for deferred maintenance (49).   All told, the Governor is proposing a $3,157,805,000 General Fund appropriation for CSU in 2016-2017. Again, for comparison sake, CSU's enacted General Fund Appropriation in 2007-2008 was $2,976,300,000.  So Governor Brown is proposing that CSU receive approximately $200M more from the general fund, not corrected for inflation, or enrollment increases.  The 2007-2008 budget presumed that CSU would enroll a total of 342,553 resident students. (4)  Governor Brown is projecting a resident student population 374,174 (these are FTE not actual individuals).  In inflation terms this leaves CSU several hundred million dollars behind.  And that does not account for the additional 30,000 FTE students.

The Governor has a somewhat different model for CSU, compared to UC, as his CSU widget theory of higher education focuses more on 4 year graduation rates.  Once again, the Governor is fixated on technology and fails to see that if he expects CSU to dramatically increase these rates he will need to do more than simply hector CSU while providing minor incremental increases in funding.  Instead, the State will need to commit to providing the funds needed to expand faculty and staff in order to improve graduation rates and the teaching resources available to the system's educators.

I'll add another word about the way the Governor continues to vest his higher education hopes in technocratic solutions. The most obvious of these continues to be his insistence that problems can be solved through online education.  But just as striking is his office's insistence that the problems facing higher education in the 21st century can be solved by accelerating throughput of students into the workforce.  I found nothing in the Governor's discussion of higher education that indicated any awareness that as they face a complex world of  local and international challenges, students might need to develop more knowledge, not less, by acquiring more complex skills and interdisciplinary knowledge structures, which is likely to take more time, not less.  The pressure he puts on UC and CSU is to cut costs, not to improve quality.  Now I agree that shortening time to degree is important; but the way to do that is to provide adequate funding to enable students to focus on their studies.  When all you want to use is a hammer, everything looks like a nail--even human beings.

The state does have money to start improving higher education again, rather than just chiding and squeezing it.  As the California Budget and Policy Center has pointed out, the Governor's obsession with the State's Rainy Day Fund has led him to refuse to spend $2 billion that could be appropriated. The Governor is reasonably afraid of a recession in the next few years.  But as his budget acknowledges, the recovery has hardly been shared equally (10) and as I have indicated above his proposals do more than resist new commitments--they continue to lock in recession-era losses.  This Governor's budget makes clear, as we enter the twilight of his political career, that he will be remembered for failing to promote a politics of hope rather than succumbing to the politics of fear that has governed the state since Howard Jarvis embarrassed him in the late 1970s.